Amazon DocumentDB

This guide explains how to add Amazon DocumentDB, a MongoDB-compatible document database, as a resource in StrongDM.

Limitations #

• The DocumentDB datasource supports username/password authentication. It does not support IAM or AWS Directory Service authentication.
• DocumentDB requires TLS to connect.
• DocumentDB does not support connection using service (SRV) records.
• When creating a DocumentDB (replica set mode) resource, the Hostname field must be set with the hostnames and ports of all instances in the replica set separated by commas (for example, primary0:27017,replica1:27017,replica2:27017).
• AWS Directory Service integration is not supported.

Configuration Properties #

StrongDM offers two DocumentDB datasource types: DocumentDB (replica set mode), for connecting to specified replica instances in your cluster; and DocumentDB (single host mode), for connecting to only the primary instance in your cluster.

To configure DocumentDB in either replica set mode or single host mode, first see our main guide, Add a Datasource, for general information on adding a datasource in the Admin UI. Then set the properties for your selected DocumentDB type.

DocumentDB (replica set) #

• Display Name (Required): Enter a meaningful name for this resource. This name displays throughout StrongDM. Do not include special characters like quotes (") or angle brackets (< or >).
• Datasource Type (Required): Select DocumentDB (replica set).
• Hostname (Required): Enter the hostnames and ports of all instances in the replica set. The host addresses and ports of all replica instances must be separated by commas (for example, primary0:27017,replica1:27017,replica2:27017).
• Port Override: After you click create, the port override will be filled in with a port between 1024-59999 that is not in use by another resource. You can change the port override later in Settings > Port Overrides.
• Authentication Database (Required): Enter the name of the DocumentDB authentication database (for example, “admin”).
• Secret Store: This field lets you specify where the credentials for this resource are stored. The default Secret Store type is Strong Vault. Selecting any other Secret Store type causes properties unique to that Secret Store to appear, such as Username (path), Password (path), and so forth. For more detailed information about path to the secrets you’ve stored in a particular Secret Store, see the Secret Store integration configuration guide for the one you are using.
• Username (Required): This field is shown when Secret Store integration is not configured for your organization, or when it is and StrongDM is the selected Secret Store type. Enter the username (for example, administrator@example.com) used for authentication to DocumentDB.
• Username (path) (Required): If Secret Store integration is configured for your organization and you selected a Secret Store type that is not StrongDM, enter the path to the secret in your Secret Store (for example, path/to/credential?key=optionalKeyName). The key argument is optional.
• Password (Required): This field is shown when Secret Store integration is not configured for your organization, or when it is and StrongDM is the selected Secret Store type. Enter the password used for authentication to DocumentDB.
• Password (path) (Required): If Secret Store integration is configured for your organization and you selected a Secret Store type that is not StrongDM, enter the path to the secret in your Secret Store (for example, path/to/credential?key=optionalKeyName). The key argument is optional.
• Replica Set (Required): Enter the name of the DocumentDB replica set.
• Connect to Replica? (Optional): When this option is selected, StrongDM will connect to a read-only replica instance instead of the primary instance.
• Resource Tags (Optional): Assign tags to this datasource by entering key-value pairs in the format <KEY>=<VALUE> (for example, env=dev, region=east, and so forth).

DocumentDB (single host) #

• Display Name (Required): Enter a meaningful name for this resource. This name displays throughout StrongDM. Do not include special characters like quotes (") or angle brackets (< or >).
• Datasource Type (Required): Select DocumentDB (single host).
• Hostname (Required): Enter the instance endpoint for your DocumentDB cluster, such as sample-instance.123456789012.us-east-1.docdb.amazonaws.com.
• Port (Required): The default port is 27017.
• Bind Interface (Read only): Bind Interface is the IP address to which the port override of this resource is bound. The IP address value is automatically generated in the 127.0.0.1 to 127.255.255.254 IP address range after the resource is created. The default is 127.0.0.1. You can modify this value with your preferred bind interface value later under Settings > Port Overrides.
• Port Override (Read only): After you click create, the port override will be filled in with a port between 1024-59999 that is not in use by another resource. You can change the port override later in Settings > Port Overrides.
• Authentication Database (Required): Enter the name of the DocumentDB authentication database (for example, “admin”).
• Secret Store (Optional): This field lets you specify where the credentials for this resource are stored. The default Secret Store type is Strong Vault. Selecting any other Secret Store type causes properties unique to that Secret Store to appear, such as Username (path), Password (path), and so forth.
• Username (Required): This field is shown when Secret Store integration is not configured for your organization, or when it is and StrongDM is the selected Secret Store type. Enter the username, such as administrator@example.com, that is used for authentication to DocumentDB.
• Username (path) (Required): If Secret Store integration is configured for your organization and you selected a Secret Store type that is not StrongDM, enter the path to the secret in your Secret Store, such as path/to/credential?key=optionalKeyName. The key argument is optional.
• Password (Required): This field is shown when Secret Store integration is not configured for your organization, or when it is and StrongDM is the selected Secret Store type. Enter the password used for authentication to DocumentDB.
• Password (path) (Required): If Secret Store integration is configured for your organization and you selected a Secret Store type that is not StrongDM, enter the path to the secret in your Secret Store (for example, path/to/credential?key=optionalKeyName). The key argument is optional.
• Resource Tags (Optional): Assign tags to this datasource by entering key-value pairs in the format <KEY>=<VALUE> (for example, env=dev, region=east, and so forth).

Test the Connection #

After you have created the DocumentDB datasource, you can use the MongoDB Shell to test the connection to DocumentDB.

1. Run the following command to connect to the instance running on your localhost:
   mongosh "mongodb://localhost:<PORT>/admin"

   Example:
   mongosh "mongodb://localhost:37018/admin"

2. Once connected, execute the following command to see the databases:
   show dbs